jszip (npm) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the npm package jszip, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (2)

• CVE-2022-48285 — CVSS 7.3 (high): loadAsync in JSZip before 3.8.0 allows Directory Traversal via a crafted ZIP archive.
• CVE-2021-23413 — CVSS 5.3 (medium): This affects the package jszip before 3.7.0. Crafting a new zip file with filenames set to Object prototype values (e.g __proto__…